Description
Multiple DrayTek VigorAP models contain a command injection vulnerability in the InquierTime function. The vulnerability is caused by insufficient filtering of the time field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.
Published: 2026-08-24
Score: 8.6 High
EPSS: 3.1% Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is an OS command injection in the InquireTime function of DrayTek VigorAP firmware. Insufficient filtering of the time field allows the injection of arbitrary shell commands that are executed with root privileges, giving the attacker complete control over the device and potentially the entire connected network.

Affected Systems

DrayTek VigorAP 1060C, VigorAP 903, VigorAP 906, VigorAP 912C, VigorAP 918R, and VigorAP 960C are affected. Specific vulnerable firmware versions are not listed in the advisory, so all current firmware releases for these models are potentially impacted.

Risk and Exploitability

The CVSS score of 8.6 indicates a high severity flaw. The EPSS score is 3%, indicating a moderate probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a remote attacker authenticating to the device’s web management interface and sending crafted InquireTime input. Successful exploitation would lead to arbitrary command execution with root privileges.

Generated by OpenCVE AI on August 25, 2026 at 14:34 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade all affected VigorAP devices to the latest firmware released by DrayTek that patches the InquireTime command injection flaw.
  • Restrict or block remote access to the web management interface, limiting it to trusted internal networks or VPN connections only.
  • Implement strong, multi‑factor authentication for all administrative accounts and regularly audit login activity for anomalous InquireTime requests.

Generated by OpenCVE AI on August 25, 2026 at 14:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 24 Aug 2026 21:30:00 +0000

Type Values Removed Values Added
First Time appeared Draytek vigorap 1060c
Draytek vigorap 903
Draytek vigorap 906
Draytek vigorap 912c
Draytek vigorap 918r
Draytek vigorap 960c
Vendors & Products Draytek vigorap 1060c
Draytek vigorap 903
Draytek vigorap 906
Draytek vigorap 912c
Draytek vigorap 918r
Draytek vigorap 960c
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 24 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
Description Multiple DrayTek VigorAP models contain a command injection vulnerability in the InquierTime function. The vulnerability is caused by insufficient filtering of the time field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.
Title DrayTek VigorAP Multiple Models OS Command Injection via InquierTime
First Time appeared Draytek
Draytek vigorap 1060c Firmware
Draytek vigorap 903 Firmware
Draytek vigorap 906 Firmware
Draytek vigorap 912c Firmware
Draytek vigorap 918r Firmware
Draytek vigorap 960c Firmware
Weaknesses CWE-78
CPEs cpe:2.3:o:draytek:vigorap_1060c_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:draytek:vigorap_903_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:draytek:vigorap_906_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:draytek:vigorap_912c_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:draytek:vigorap_918r_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:draytek:vigorap_960c_firmware:*:*:*:*:*:*:*:*
Vendors & Products Draytek
Draytek vigorap 1060c Firmware
Draytek vigorap 903 Firmware
Draytek vigorap 906 Firmware
Draytek vigorap 912c Firmware
Draytek vigorap 918r Firmware
Draytek vigorap 960c Firmware
References
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Draytek Vigorap 1060c Vigorap 1060c Firmware Vigorap 903 Vigorap 903 Firmware Vigorap 906 Vigorap 906 Firmware Vigorap 912c Vigorap 912c Firmware Vigorap 918r Vigorap 918r Firmware Vigorap 960c Vigorap 960c Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-24T19:53:01.368Z

Reserved: 2026-08-08T16:37:44.517Z

Link: CVE-2026-71909

cve-icon Vulnrichment

Updated: 2026-08-24T19:52:57.469Z

cve-icon NVD

Status : Deferred

Published: 2026-08-24T18:17:02.593

Modified: 2026-08-26T17:10:09.810

Link: CVE-2026-71909

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-25T14:45:03Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')